2 Answers
2

You probably can't (at least not reasonably). Tools like SQL Developer are going to query ALL_USERS to get the list of users and that will show all the users in the database to any user that has the ability to log in. Is it really a security risk for A to know that a user B exists if A can't see anything else about B?

While I would strongly advise against it, you may be able to work around the problem by creating an ALL_USERS view in the nonprivileged user's schema (or creating a private synonym to a view in a different schema) that has the same structure as ALL_USERS but has less data. Since most tools don't qualify the names of data dictionary tables SYS.ALL_USERS rather than just ALL_USERS, this trick generally works. There are substantial risks, though. Inevitably, there are unexpected downsides when some install script expects that the data dictionary is "normal", eventually someone will use a tool that does fully qualify the data dictionary table name, etc.

Thanks Justin. Our goal was "in case one user is compromised, at least it does not give away the usernames of all others, which may allow someone to try and work their way forwards".
–
learningOracleMay 4 '12 at 21:51

1

Yes, it's a security risk to disclose usernames. There are worse risks, and you have to consider the user population and sensitivity of the data in the system. It might be OK.
–
Andrew WolfeMay 5 '12 at 2:48